Security audit

Refacil Pay Setup

Security checks for vulnerabilities and agentic risk

Overview

This setup skill is transparent about installing Refacil Pay tooling, but it delegates persistent agent instructions to an unpinned external npm package in a payment context.

Install only if you trust the refacil-pay-cli npm package and its publisher. Prefer a pinned, reviewed package version, inspect the generated operating skill and AGENTS.md before activation, avoid automatic --yes installation when possible, and confirm any payment or money movement action explicitly before it runs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:18
Finding: Unpinned npm Package Installation Executes Untrusted Lifecycle Code
Content: View full analysis
- If set, the package's postinstall skips automatic skill installation. Leave unset for normal setup; this skill installs the operating skill explicitly via `skills install --path`. ``` ```markdown ## Step 1 — Ensure the CLI is installed If your host already installed the `install: node` dependency, the binary is present. Otherwise install it globally: ```bash npm install -g refacil-pay-cli ``` Verify (if this fails, install is not complete — do not continue): ```bash refacil-pay-cli --version ``` > No global write access (sandbox)? Use `npx refacil-pay-cli ` instead, or > install into a prefix you control and add it to `PATH`. ``` ### Technical Analysis The installation commands do not specify an exact package version or integrity hash. Consequently, each installation may retrieve a different release from the npm registry. Both global npm installation and `npx` can execute package-controlled JavaScript, including npm lifecycle hooks. The configuration explicitly documents that the package has a `postinstall` behavior capable of automatically installing skills unless `REFACIL_PAY_CLI_NO_SKILLS` is set. The recommended normal setup leaves that variable unset. This gives an externally maintained and mutable package an execution path during installation and allows it to modify the agent environment before its contents are reviewed. Although the audited file contains no embedded malicious payload, its dependency handling creates a supply-chain trust boundary. A compromised publisher account, registry response, or future package release could change the code executed by the same instructions without requiring any modification t ...[truncated 1371 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:62
Finding: Mutable Package-Supplied Instructions Are Treated as Authoritative Agent Policy
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:75
Finding: Unreviewed Package-Controlled Skills Are Installed into the Active Agent Environment
Content: View full analysis
``` `--path` writes the skill files to that exact directory with no IDE detection, so any host carries it. If you are one of the auto-detected IDEs (Claude Code, Cursor, OpenCode, Codex, Antigravity), you may instead run the non-interactive detect form: ```bash refacil-pay-cli skills install --yes ``` > Never run the bare `refacil-pay-cli skills install` or `init` in a non-TTY agent > shell — the interactive form hangs. Always use `--path `, `--ide `, or `--yes`. ``` ### Technical Analysis The skill invokes package-controlled installer logic and directs it to write operating skill files into the directory from which the agent loads behavioral instructions. No staging, file manifest, checksum validation, content review, overwrite protection, or approval step is required before activation. The explicit `--path` form can target the active agent skill directory directly. The `--yes` form additionally permits automatic environment detection, reducing visibility into the selected destination. Because the source package is externally maintained and unpinned, the installed files can change independently of the audited bootstrap skill. This establishes a supply-chain path through which package content can become persistent agent configuration. It may also overwrite or conflict with existing files, depending on installer behavior; the audited project does not define safeguards against that possibility. ...[truncated 1304 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The skill instructs users to run npx refacil-pay-cli <command> without pinning an exact package version. npx may fetch the latest package at execution time, which creates a supply-chain risk: a compromised publisher account, malicious new release, or typo/registry confusion could cause unreviewed code to execute in the agent environment.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.